Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

1.19 TC-10-CorruptImage
FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)
Test Case TC-10-CorruptImage (FTK Imager 2.9.0.1385)
Test &
Case
Summary:
Try verifying a corrupted image
Notes: The image of FAT32 partition.
Assertion: AFR-03 The tool operates in an execution environment
AIC-06 If the image file integrity check is selected, the tool shall report
to the user the image file has not been changed if the image file
has not been changed.
AIC-07 If the image file integrity check is selected, the tool shall report
to the user the image file has been changed if the image file
has been changed.
AIC-08 If the image file integrity check is selected, the tool shall report
to the user the image file has been changed and the involved
location if the image file has been changed.
ALOG-01 If the tool logs any information regarding to the acquisition,
the information is accurately logged in the log file.
ALOG-02 The tool display correct information about the acquisition to
the user.
ALOG-03 The tool display correct information regarding to the
acquisition to the user and the information displayed is
Source
Device:
Drive
Setup:
Partition
Setup:
Log
highlights:
consistent with the log file if the log file function is supported
Drive Model: ST380811 AS (80GB)
Serial Number: 6PS2CA4Z
Sector count: 156,296,385
Write blocker: N/A
Source image hashes
MD5 checksum: 2c22fded78dc8ccc2c935944883a2e1b
SHA1 checksum: 10eaa99a609cd8d215c9dc5a68f46e2e0d5c68c5
Total sectors: 2104452 (1027MB)
Address: Offset 35df5f70h Column 8 change byte from 43 to 42
/dev/sda: current max LBA: 156,296,385
/dev/sda: native max LBA: 156,296,385
/dev/sda: physical max LBA: 156,296,385
/dev/sda: HPA not set
/dev/sda: DCO not set
Device Start End #Sectors File System
/dev/sda1 63 41945714 41945652 HPFS/NTFS
/dev/sda2 4192965 156296384 152103420 Extended
/dev/sda5
/dev/sda6
4193028
6297543
6297479
10490444
2104452
4192902
FAT32
FAT16
/dev/sda7 10490508 12594959 1052226 Ext2
/dev/sda8 12595023 14699474 2104452 Ext3
/dev/sda9 14699538 18892439 4192902 HPFS/NTFS
/dev/sda10 18892503 19149479 256977 Swap
unallocated 19149480 156296384 137146905 Empty
Created By AccessData® FTK® Imager 2.9.0.1385 100406
Notes: Acquire FAT32 partition only (sector first from 4193028 to
6297479. total: 2104452).
186